Re: Learning how-to pf "right"
Evaldas Auryla <[email protected]> Wed, 13 May 2015 09:14:13 +0200
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------020002080004050409050007
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Hi Dennis,
I used the last approach you mention: 4) untouched, then block rules,
basically using these guidelines:
- avoid using "quick"
- firewall policy is managed on "in"
- start with default block all
block log all label "blocked"
- first block of "pass" rules is for traffic going outside to Internet
(with any)
- second block that follows is "stealth block", this cancels "any"
effect for lans protected by firewall
block in log from any to $lan1 label "blocked_perimeter"
block in log from any to $lan2 label "blocked_perimeter"
block in log from any to $lan3 label "blocked_perimeter"
..
- then follow "pass" blocks that enable access to specific services on
protected lans
- final "pass out log all"
Best regards,
Evaldas
On 13/05/15 00:36, Dennis Steinkamp wrote:
> Hey there,
>
> i am a heavy pfsense user and i thought why not spend a little
> "free-time" and learn more about "pf" itself. :)
> So i got myself a copy of the 3rd edition of "The book of Pf" and
> started to work with it.
>
> I created my first rules to the point where pf can already act as an
> internet gateway for a few subnets on my local network.
> Even though it works fine i have a question on how to achieve a
> certain configuration to which i am used to.
> The problem is surely on my side so please bear with me if my question
> sounds naive or stupid. (which it surely will^^)
>
> Let me show you my current ruleset first:
>
> 1.) block all
> 2.) set skip on lo
> 3.) match out on egress inet from $int_net nat-to egress
> 4.) pass in on $int_if from $int_net to *any*
> 5.) pass out on $ext_if from $ext_if to any
>
> As far as i know, in order to grant my client machines in the local
> network access to the internet the keyword*"any"* in rule 4.) is
> neccessary for obvious reasons. But of course "any" would imply all
> other interfaces to where i maybe want to restrict accessx to.
> My understanding was, i would just grant my clients access to the WAN
> interface (or the egress interface) so that they can surf the web etc.
> but at the same time are locked out to access other interfaces, until
> i create rules for it, thats the kind of configuration i am probably
> used to, due to my pfsense background.
> My question therefor is, how can i achieve a similar configuration
> with "pf" or maybe i am just interested what the best/common practice
> for that scenario is.
> Can, i for example combine *any *with != so that traffic destined for
> the internet passes but at the same time traffic destined to vlans
> (!=vlan100 .... 400) or physical networks does not?
> The other approach would probaly be leave rule 4.) untouched and
> restrict the "any" later with block rules (e.g block in from $int_net
> to "{ vlan100, vlan200 ...}" because afaik with pf the last rule that
> fits the criteria, wins (until i use quick)
>
> Thank you in advance for any help you are willing to provide. Progress
> comes slowly with me ^^
>
> Regards
>
> Dennis
>
>
--------------020002080004050409050007
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi Dennis,<br>
<br>
I used the last approach you mention: 4) untouched, then block
rules, basically using these guidelines:<br>
<br>
- avoid using "quick"<br>
<br>
- firewall policy is managed on "in"<br>
<br>
- start with default block all<br>
<br>
block log all label "blocked"<br>
<br>
- first block of "pass" rules is for traffic going outside to
Internet (with any)<br>
<br>
- second block that follows is "stealth block", this cancels "any"
effect for lans protected by firewall<br>
<br>
block in log from any to $lan1 label "blocked_perimeter"<br>
block in log from any to $lan2 label "blocked_perimeter"<br>
block in log from any to $lan3 label "blocked_perimeter"<br>
...<br>
<br>
- then follow "pass" blocks that enable access to specific
services on protected lans<br>
<br>
- final "pass out log all"<br>
<br>
<br>
Best regards,<br>
Evaldas<br>
<br>
On 13/05/15 00:36, Dennis Steinkamp wrote:<br>
</div>
<blockquote cite="mid:[email protected]" type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
Hey there,<br>
<br>
i am a heavy pfsense user and i thought why not spend a little
"free-time" and learn more about "pf" itself. :)<br>
So i got myself a copy of the 3rd edition of "The book of Pf" and
started to work with it.<br>
<br>
I created my first rules to the point where pf can already act as
an internet gateway for a few subnets on my local network.<br>
Even though it works fine i have a question on how to achieve a
certain configuration to which i am used to.<br>
The problem is surely on my side so please bear with me if my
question sounds naive or stupid. (which it surely will^^)<br>
<br>
Let me show you my current ruleset first:<br>
<br>
1.) block all<br>
2.) set skip on lo<br>
3.) match out on egress inet from $int_net nat-to egress<br>
4.) pass in on $int_if from $int_net to <b>any</b><br>
5.) pass out on $ext_if from $ext_if to any<br>
<br>
As far as i know, in order to grant my client machines in the
local network access to the internet the keyword<b> "any"</b> in
rule 4.) is neccessary for obvious reasons. But of course "any"
would imply all other interfaces to where i maybe want to restrict
accessx to. <br>
My understanding was, i would just grant my clients access to the
WAN interface (or the egress interface) so that they can surf the
web etc. but at the same time are locked out to access other
interfaces, until i create rules for it, thats the kind of
configuration i am probably used to, due to my pfsense background.<br>
My question therefor is, how can i achieve a similar configuration
with "pf" or maybe i am just interested what the best/common
practice for that scenario is.<br>
Can, i for example combine <b>any </b>with != so that traffic
destined for the internet passes but at the same time traffic
destined to vlans (!=vlan100 .... 400) or physical networks does
not?<br>
The other approach would probaly be leave rule 4.) untouched and
restrict the "any" later with block rules (e.g block in from
$int_net to "{ vlan100, vlan200 ...}" because afaik with pf the
last rule that fits the criteria, wins (until i use quick)<br>
<br>
Thank you in advance for any help you are willing to provide.
Progress comes slowly with me ^^<br>
<br>
Regards<br>
<br>
Dennis<br>
<br>
<br>
</blockquote>
<br>
</body>
</html>
--------------020002080004050409050007--